CVE-2023-5821: Undefined Security Weakness

The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they c...

PT-2023-31136

Name of the Vulnerable Software and Affected Versions The BEAR for WordPress versions up to, and including, 1.1.3.3 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the woobe bulk delete products function. This allows unauthenticated...

CVE-2023-2892

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the processbulkdeleteproduct function. This makes it possible for unauthenticated attackers to bulk delete products via...

Cross site request forgery (csrf)

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the processbulkdeleteproduct function. This makes it possible for unauthenticated attackers to bulk delete products via...

CVE-2023-2892 WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the processbulkdeleteproduct function. This makes it possible for unauthenticated attackers to bulk delete products via...

PT-2023-22038 · WordPress · Wp Easycart

Name of the Vulnerable Software and Affected Versions: WP EasyCart plugin for WordPress versions up to, and including, 5.4.8 Description: The issue is due to missing or incorrect nonce validation on the process bulk delete product function, making it possible for unauthenticated attackers to bulk...

CVE-2023-2892: Cross-Site Request Forgery (CSRF)

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the processbulkdeleteproduct function. This makes it possible for unauthenticated attackers to bulk delete products via...

CVE-2022-4266

The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete non admin users by knowing their email via a CSRF attack...

CVE-2022-4267

The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-4267 Bulk Delete Users by Email <= 1.2 - Reflected Cross-Site Scripting

The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-4267

CVE-2022-4267 concerns the WordPress plugin Bulk Delete Users by Email (versions up to 1.2 as stated in the primary description). The vulnerability is a reflected cross-site scripting (XSS) caused by lack of proper sanitisation/escaping of a parameter that is output back into the page. Several co...

WordPress plugin Bulk Delete Users by Email 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2022-26505 · WordPress · Bulk Delete Users By Email

Name of the Vulnerable Software and Affected Versions: Bulk Delete Users by Email WordPress plugin versions prior to 1.3 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back i...

CVE-2022-4267: Undefined Security Weakness

The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-4266: Undefined Security Weakness

The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete non admin users by knowing their email via a CSRF attack...

CVE-2022-0477

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries...

PT-2022-13202 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 11.9 through 14.5.3 GitLab versions 14.6.0 through 14.6.3 GitLab versions 14.7.0 Description: An issue has been discovered in GitLab where it was not correctly handling bulk requests to delete existing packages from the packag...

CVE-2022-0328: Cross-Site Request Forgery (CSRF)

The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack...

CVE-2021-24749

The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack...

CVE-2021-24749

The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack...